Managed Identity Sign-in Logs

Success: Successful sign-in

Record grouping: This catalog entry is a repository-authored classifier over real records, not a vendor operation name. Any sample below is a representative record for the grouping.

Description

Record with ResultType 0: the managed identity's token acquisition completed successfully.

Representative record #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Blocked-by-CA: Sign-in blocked by Conditional Access

Record grouping: This catalog entry is a repository-authored classifier over real records, not a vendor operation name. Any sample below is a representative record for the grouping.

Description

Record with ResultType 53003 (or one of the further Conditional-Access-related block codes 53000, 53001, 53002, 50131, 50158, 50097): a Conditional Access policy returned a block decision for the managed identity's sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.

Other: Sign-in with another recorded result

Record grouping: This catalog entry is a repository-authored classifier over real records, not a vendor operation name. Any sample below is a representative record for the grouping.

Description

Record whose ResultType is not 0 or a Conditional-Access block code. The table's own column doc describes ResultType as Success-or-Failure; this bucket holds every other failure code.

Target application: Sign-in naming a target application

Record grouping: This catalog entry is a repository-authored classifier over real records, not a vendor operation name. Any sample below is a representative record for the grouping.

Description

Record carrying AppId or ResourceDisplayName: the application identifier and the resource the managed identity signed into.

Representative record #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Conditional Access status: Sign-in recording a Conditional Access status

Record grouping: This catalog entry is a repository-authored classifier over real records, not a vendor operation name. Any sample below is a representative record for the grouping.

Description

Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the managed identity's sign-in.

Representative record #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

any: Sign-in record (AADManagedIdentitySignInLogs, any result)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Description

Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`AppId`	15 detection rules	Elastic, Panther
`OperationName`	10 detection rules	Elastic, Panther, Splunk
`UserAgent`	10 detection rules	Elastic, Panther
`ResultType`	9 detection rules	Elastic, Panther, Splunk
`ResultSignature`	8 detection rules	Elastic, Panther
`ResourceDisplayName`	6 detection rules	Elastic, Panther
`Category`	5 detection rules	Elastic, Panther, Splunk
`AppOwnerTenantId`	2 detection rules	Elastic
`AuthenticationProcessingDetails`	2 detection rules	Elastic
`ConditionalAccessStatus`	2 detection rules	Elastic
`Identity`	2 detection rules	Elastic
`SessionId`	2 detection rules	Elastic, Panther
`IPAddress`	1 detection rule	Panther
`ResultDescription`	1 detection rule	Elastic
`TenantId`	1 detection rule	Elastic

Representative record #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppId": "b03f542d-bdd6-477f-a424-624b81305fc1",
  "AuthenticationContextClassReferences": [],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "Category": "ManagedIdentitySignInLogs",
  "ClientCredentialType": "none",
  "ConditionalAccessAudiences": [],
  "ConditionalAccessPolicies": [],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "c088ded1-23dd-4b62-8cb4-fa2ebd4de855",
  "CreatedDateTime": "2026-07-25T16:10:17.557475Z",
  "DurationMs": "0",
  "Id": "a5c6d733-08f3-4642-8d6c-4663f6f45800",
  "LocationDetails": {
    "city": "",
    "state": "",
    "countryOrRegion": "",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "ResourceDisplayName": "Microsoft Graph",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "00000003-0000-0000-c000-000000000000",
  "ResourceOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "ResourceServicePrincipalId": "2e5ab30e-ae89-43c2-b130-0022f3d655a7",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "ServicePrincipalId": "bd7574b0-c942-42da-8fa3-2cf6d9a0142c",
  "ServicePrincipalName": "dw-signin-mi-f313ab",
  "UniqueTokenIdentifier": "M9fGpfMIQkaNbEZj9vRYAA"
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`Success`	16 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`Member`	9 rules	elastic
`EventType` (elastic rule field)	eq	`Sign-in activity`	7 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000003-0000-0000-c000-000000000000`	5 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000002-0000-0ff1-ce00-000000000000`	3 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000003-0000-0ff1-ce00-000000000000`	3 rules	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	4 rules	elastic
`azure_ad::app_id` (elastic rule field)	in	`04b07795-8ddb-461a-bbee-02f9e1bf7b46`	3 rules	elastic
`azure_ad::app_id` (elastic rule field)	in	`1950a258-227b-4e31-a9cf-717495945fc2`	3 rules	elastic
`azure_ad::app_id` (elastic rule field)	in	`872cd9fa-d31f-45e0-9eab-6e460a02d1f1`	3 rules	elastic
`azure_ad::app_id` (elastic rule field)	in	`aebc6443-996d-45c2-90f0-388ff96faa56`	3 rules	elastic
`azure_ad::user_principal_name` (elastic rule field)	is_not_null		4 rules	elastic
`security_result.action (Chronicle)`	eq	`ALLOW`	4 rules	chronicle
`azure_ad::authentication_protocol` (elastic rule field)	eq	`deviceCode`	3 rules	elastic
`azure_ad::authentication_requirement` (elastic rule field)	eq	`singleFactorAuthentication`	3 rules	elastic

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Sharepoint or OneDrive Accessed by Unusual Client source medium: Identifies when an application accesses SharePoint Online or OneDrive for Business for the first time in the tenant within a specified timeframe. This detects successful OAuth phishing campaigns, illicit consent grants, or compromised third-party applications gaining initial access to file storage. Adversaries often use malicious OAuth applications or phishing techniques to gain consent from users, allowing persistent access to organizational data repositories without traditional credential theft.T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID OAuth Device Code Flow with Concurrent Sign-ins source high: Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session. This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates via browser while the requesting application polls for tokens - when these have distinctly different user agents (e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.T1078, T1078.004, T1528, T1566, T1566.002
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration source high: Correlates a successful Entra ID device-code sign-in to the legacy Azure AD Graph audience (00000002-0000-0000-c000-000000000000) from an unmanaged device with directory enumeration against graph.windows.net by the same user within a short window. Device-code phishing is the dominant OAuth phishing variant against Microsoft tenants: the adversary initiates the flow, relays the user-facing code to the victim, and on redemption walks away with an access or refresh token bound to the targeted resource without ever handling the user's password or MFA factor. When the redeemed audience is AAD Graph and the redeeming device is unmanaged, the follow-on Graph traffic is the compromised cloud account being used by the attacker, not by the user. This rule fires when that token is immediately turned around against the directory under the same identity to read user, group, service principal, application, role assignment, directory object, policy, OAuth permission grant, or tenant detail collections.T1069, T1069.003, T1078, T1078.004, T1087, T1087.004

Show 17 more (35 total) on the rules page

Splunk #

Detect Distributed Password Spray Attempts source: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different…T1110, T1110.003
Azure AD Multi-Source Failed Authentications Spike source: The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and…T1110, T1110.003, T1110.004, T1586, T1586.003
Azure AD User Consent Denied for OAuth Application source: The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. This detection leverages Azure AD's audit logs, specifically focusing on user consent…T1528

Kusto #

Lumen TI IPAddress in IdentityLogonEvents source medium: This query maps Lumen IP indicators of compromise (IOCs) from threat intelligence (TI), by searching for matches in Azure AD sign-in logs.T1071

YARA-L #

Entra ID Admin Login Activity to Uncommon MS Cloud Apps source medium: Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
Microsoft Entra ID Device code phishing attack source high: Detects strong indicators of a successful device code phishing attack.T1566
Entra ID Login Activity to Azure AD PowerShell Application source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps

Show 2 more (5 total) on the rules page

Panther #

Azure Device Code Authentication with Broker Client source medium: Detects device code authentication using the Microsoft Broker Client application, which may indicate Primary Refresh Token (PRT) abuse. Device code flow allows adversaries to trick users into entering codes on attacker-controlled applications. When combined with Microsoft Broker Client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e), this may indicate PRT theft or replay attacks that bypass MFA and Conditional Access policies.T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts source high: Detects high volumes of failed Microsoft Entra ID sign-in attempts resulting in account lockouts, indicating potential brute-force credential attacks such as password spraying, password guessing, or credential stuffing. When adversaries repeatedly attempt authentication with incorrect credentials, Entra ID Smart Lockout policies trigger account lockouts (error code 50053).T1110, T1110.001, T1110.003, T1110.004
Azure Many Failed SignIns source medium: This detection looks for a number of failed sign-ins for the same ServicePrincipalName or UserPrincipalNameT1078, T1110

Show 8 more (11 total) on the rules page

Managed Identity Sign-in Logs

Success: Successful sign-in

Description

Representative record #

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Other: Sign-in with another recorded result

Description

Target application: Sign-in naming a target application

Description

Representative record #

Conditional Access status: Sign-in recording a Conditional Access status

Description

Representative record #

any: Sign-in record (AADManagedIdentitySignInLogs, any result)

Description

Detection Fields #

Representative record #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

References #